--- name: iam-iam-login_fedid title: Logging in with a federated ID description: As a federated user that uses a corporate or enterprise single sign-on ID, you can log in to IBM Cloud® from the console by using a federated ID and password. You can also log in from the command-line interface (CLI) by using a one-time passcode or an API key. last-updated: 2026-08-18 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/iam?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Logging in with a federated ID {: #federated_id} As a federated user that uses a corporate or enterprise single sign-on ID, you can log in to IBM Cloud® from the console by using a federated ID and password. You can also log in from the command-line interface (CLI) by using a one-time passcode or an API key. {: shortdesc} By using federated IDs, you don't need to set up new login credentials specific to IBM Cloud, for example, by using IBMid. Instead, users in your organization can easily log in to IBM Cloud with their organization credentials through your identity provider (IdP). When a user logs in, the user gets an IAM token, which is a temporary credential that expires after 1 hour. After that time, the token must be refreshed to secure the connection and to continue accessing account resources to which they are assigned access. For more information about using federated IDs, see [Setting up your IBM Cloud account](https://cloud.ibm.com/docs/account?topic=account-account-getting-started&format=markdown). For more information about using federated IDs, see [Enabling authentication from an external identity provider](https://cloud.ibm.com/docs/iam?topic=iam-ibm-idp-integration&format=markdown). Google login isn't available for users with federated IDs. For more information, see [known issues and limitations](https://cloud.ibm.com/docs/account?topic=account-known-issues&interface=ui&format=markdown). {: note} ## Using the console to log in {: #login_console} {: ui} Use the following steps to log in to the IBM Cloud console: 1. Go to the [IBM Cloud login page](https://cloud.ibm.com/login). 2. Enter your ID, and click **Continue**. 3. Enter your password. After you log in, you are directed to the IBM Cloud dashboard, which provides various development, account management, and infrastructure widgets. ## Using trusted profiles to log in to the console {: #login_console_trustedprofile} {: ui} Account administrators use trusted profiles to manage specific access for account users. Each profile includes a different set of access policies that map to the roles or actions that you need to be productive. For example, a developer might use access group membership to do their daily work, but at some point during the week they might need to do some operations work in production environments. In this case, the developer would authenticate themselves and then take explicit action to apply a trusted profile that has the access policies they need to do operations work in production. ### Applying a trusted profile {: #apply-profile} After you log in with a federated ID, the profile selection page displays all trusted profiles available to you. You can: - **Search** profiles by trusted profile name, account name, or description - **Filter** by account, profile type (Individual or Federated), or pinned profiles - **Switch views** between Grid view (detailed tiles) and List view (table format) - **Pin profiles** to mark frequently used profiles so they appear at the top of the list Click **Use** next to the profile you want to apply, or click **Continue** to access the account with base permissions only. For more information, see [Understanding the profile selection experience](https://cloud.ibm.com/docs/iam?topic=iam-create-trusted-profile&format=markdown#profile-selection-experience). ### Switching profiles after login {: #switch-profiles-after-login} After you are logged in, you can switch between trusted profiles without logging out by using the profile switcher in the upper right corner of the console. From the profile switcher, you can view your current profile, switch to other profiles in the current account, switch back to your own user identity, and access profile details and CLI login information. ### Applying trusted profiles as an IBMid user {: #login-ibmid-users} If you are an IBMid user, complete the following steps to log in to the IBM Cloud console by using a trusted profile: 1. Go to the [IBM Cloud login page](https://cloud.ibm.com/login). 2. Enter your IBMid, or if you are using single sign-on (SSO), enter your company email address, and click **Continue**. 3. Enter your password. 4. On the profile selection page, browse or search for the profile you want. Use the Grid or List view toggle, the search bar, or filters to narrow your options. Click **Use** next to the profile you want to apply, or click **Continue** to proceed without applying a profile. ### Applying trusted profiles as an App ID user {: #login-appid-users} If you are an App ID user, complete the following steps to log in to the IBM Cloud console by using a trusted profile: 1. Go to the `` for your organization. If you don't know the ``, ask your administrator. They have access to it from the Identity provider page. For more information, see [Logging in with external identity provider credentials](https://cloud.ibm.com/docs/iam?topic=iam-ibm-idp-integration&format=markdown#log-in-external-idp) {: tip} 2. Enter your credentials and log in. 3. On the profile selection page, browse or search for the profile you want, and click **Use**. Or click **Continue** to proceed without applying a profile. ### Applying trusted profiles as a user federated with IBM Cloud SAML {: #login-federated-saml} If you are a user federated with IBM Cloud SAML, complete the following steps to log in to the IBM Cloud console by using a trusted profile: 1. Go to the `` for your organization. If you don't know the ``, ask your administrator. They have access to it from the Identity provider page. For more information, see [Logging in with external identity provider credentials](https://cloud.ibm.com/docs/iam?topic=iam-ibm-idp-integration&format=markdown#log-in-external-idp) {: tip} 2. Enter your credentials and log in. 3. On the profile selection page, browse or search for the profile you want, and click **Use**. Or click **Continue** to proceed without applying a profile. ## Using the CLI to log in {: #usingthecli_login} {: cli} You choose to use either a one-time passcode or an API key to log in by using the CLI. You can find details based on whether you're using the IBM Cloud or Red Hat OpenShift CLI in the following sections. ### Using a one-time passcode to log in with the CLI {: #onetime_passcode} When you use the one-time passcode option to log in with a federated ID, you specify the single-sign-on (SSO) parameter to get a one-time passcode, which you then enter at login. Because a one-time passcode retrieves code from the IBM Cloud console, it causes the use of a federated ID in your automation script to fail. Avoid trouble by using the API key option with an automated script. {: tip} #### From the IBM Cloud CLI {: #login_cli} You can use two different methods to log in with the CLI. For the first method, use the following steps: 1. Specify the `--sso` option with the `ibmcloud login` command. 2. Follow the URL in the prompt to get the one-time passcode. 3. Copy and paste the passcode value in the CLI as your input. ```bash ibmcloud login --sso API endpoint: https://cloud.ibm.com Get One Time Code from https://identity-2.us-south.iam.cloud.ibm.com/identity/passcode to proceed. Open the URL in the default browser? [Y/n]> One Time Code > Authenticating... OK ``` {: pre} If you're already logged in to the console, you can use the following steps: 1. In the IBM Cloud console, click the **Avatar** icon ![Avatar icon](../icons/i-avatar-icon.svg "Avatar") > **Log in to CLI and API**. 2. Copy the information for the IBM Cloud CLI into the CLI. #### From the Red Hat OpenShift CLI {: #openshift_cli} You can log in with a one-time passcode by using the following steps: 1. Log in to the console, and from the console, click the **Avatar** icon ![Avatar icon](../icons/i-avatar-icon.svg "Avatar") > **Log in to CLI and API**. 2. Copy the information for the Red Hat OpenShift CLI and paste into the CLI. ### Using an API key in the CLI for authentication {: #api_key} The required API key is the IBM Cloud API key that is used to authenticate with the IBM Cloud platform, not the classic infrastructure API key, or IBM Cloud service API key. 1. Create an API key with the [`ibmcloud iam api-key-create` command](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iam&format=markdown#ibmcloud_iam_api_key_create). Use the `--file` option to generate an API key file instead of showing the key in the command window: ```bash ibmcloud iam api-key-create NAME [-d DESCRIPTION] [--file FILE] ``` {: pre} 2. Log in with the API key. You can use the API key with the IBM Cloud CLI in any of the following ways: * Call the API key directly: ```bash ibmcloud login --apikey API_KEY_STRING ``` {: pre} * Call the API key with the key file: ```bash ibmcloud login --apikey @key_file_name ``` {: pre} * Set an environment variable. Also, you can also set an environment variable on your system. For example, IBMCLOUD_API_KEY=api_key_string, where `api_key_string` is the custom value of the API key. After the environment variable is set, you can simply specify `ibmcloud login` from the CLI. For Windows 10 PowerShell, you want to use `'@key_file_name'` with single quotation marks around the key file name. {: tip} ## Using an API key to get an IAM token for authentication {: #using_apikey} {: api} You can use an API key to get an IAM token to access your IBM Cloud services. For example, you can run the following curl command to use an API key that is named `MY_APIKEY` to get an IAM token: ```bash curl -X POST 'https://iam.cloud.ibm.com/identity/token' -H 'Content-Type: application/x-www-form-urlencoded' -d 'grant_type=urn:ibm:params:oauth:grant-type:apikey&apikey=MY_APIKEY' ``` {: pre} For more information, see [Creating an IAM access token for a user or service ID by using an API key](https://cloud.ibm.com/apidocs/iam-identity-token-api#gettoken-apikey).